Experts warn of actively exploited FreePBX zero-day

Sangoma’s FreePBX Security Team has warned of an actively exploited zero-day vulnerability in FreePBX, tracked as CVE-2025-57819 with a CVSS score of 10.0, affecting systems exposed to the internet via an administrator control panel. The advisory states that attackers exploited a validation or sanitisation error in the endpoint module of FreePBX v16–17, chaining intrusions to potentially gain root access on target systems.

The root cause lies in insufficiently sanitised user-supplied data, enabling unauthenticated access to the FreePBX Administrator and arbitrary database manipulation and remote code execution. Exploitation began on or before 21 August 2025, and has been observed in the wild, targeting FreePBX versions 15 prior to 15.0.66, 16 prior to 16.0.89, and 17 prior to 17.0.3.

Users are urged to update FreePBX, restrict public ACP access, and check for indicators of compromise such as modified or missing /etc/freepbx.conf, the presence of /var/www/html/.clean[.]sh, unusual POST requests to modular.php, calls to extension 9998, and suspicious ampuser entries, with details according to Netlas researchers.